Akin HTTP request fingerprint

a11cun030_00000049_54d07b6d

Seen 2026-09-22 to 2026-09-24 across the retained window.

The feed is a URL your firewall, MISP or SIEM polls; it needs a free account so it can be revoked. Or watch the top network: AS45102 sends an email when it next hits a sensor.

1.2K

Source IPs

Networks

Countries

1.6K

Ports hit

3.4K

Events

IPs / network

Top networks

AS45102 Alibaba (US) Technology Co., Ltd.825 IPs1.0K

AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED228 IPs1.8K

AS396982 Google LLC109 IPs128

AS6939 Hurricane Electric LLC14 IPs16

AS50219 Valence Technology Co.10 IPs114

AS10439 CariNet, Inc.10 IPs96

AS142002 Scloud Pte Ltd6 IPs32

AS14061 DigitalOcean, LLC4 IPs11

AS32475 Internap Holding LLC3 IPs39

AS37963 Hangzhou Alibaba Advertising Co.,Ltd.2 IPs4

AS48090 Techoff Srv Limited1 IPs185

AS198610 Beget LLC1 IPs16

Countries

US 447JP 160DE 155MY 141SG 130HK 81TH 37GB 23NG 19BE 8

Ports targeted

3306/tcp 121 3000/tcp 68 9200/tcp 37 10000/tcp 14 8008/tcp 14 8080/tcp 13 80/tcp 13 9443/tcp 12 8000/tcp 12 7777/tcp 12 10002/tcp 11 9999/tcp 11

What it requests

GET/3.0K

GET/favicon.ico249

HEAD/selfupdate/wuident.cab16

GET/_cat/indices7

GET/_cat/indices?v=true4

GET/.env.tmp2

GET/.env.server2

GET/local_settings.py2

GET/.htpasswd2

GET/.env.temp2

GET/config.php.save2

GET/console/api_server_status2

User agents claimed

curl/7.29.0234 IPs1.8K

curl/7.64.1826 IPs1.0K

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.3623 IPs249

curl/8.5.03 IPs203

curl/7.68.0102 IPs124

Source IPCCNetwork Last seenEvents

93.123.109.214BGAS48090 Techoff Srv Limited2026-09-23185

203.55.131.3USAS32475 Internap Holding LLC2026-09-2434

216.226.76.30USAS50219 Valence Technology Co.2026-09-2424

71.6.134.204USAS10439 CariNet, Inc.2026-09-2422

152.32.252.233HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2421

216.226.76.10USAS50219 Valence Technology Co.2026-09-2420

165.154.40.42HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2420

216.226.77.10USAS50219 Valence Technology Co.2026-09-2419

165.154.129.74GBAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2418

101.36.124.220HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2418

165.154.172.223USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2418

152.32.235.69USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2418

71.6.134.232USAS10439 CariNet, Inc.2026-09-2417

123.58.213.117HKAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416

165.154.206.139USAS142002 Scloud Pte Ltd2026-09-2416

109.172.37.101RUAS198610 Beget LLC2026-09-2416

165.154.173.120USAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416

152.32.157.173GBAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416

152.32.141.9NGAS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED2026-09-2416

71.6.134.236USAS10439 CariNet, Inc.2026-09-2416

Related fingerprints

Clients whose header set is within two of this one, measured from the tokens themselves.

a11cun030_00000049_03330a18same header set4 IPs36.9K a10cun030_00000049_54d07b6dsame header set3 IPs24 a10cun041_00000049_8cf638c8same header set1 IPs3 a11cun030_00000049_0a773432same header set1 IPs1 a11cun040_0000004d_aa48e2c81 header apart2.2K IPs38.6K a10cun020_00000041_0a8d7f111 header apart1.5K IPs23.5K a11cun040_0000004d_4110f1561 header apart15 IPs7.6K a11cun040_0000004b_4c87b06e1 header apart127 IPs1.9K

About this fingerprint

Akin fingerprints an HTTP client from the request head alone: the protocol version, line endings, body framing, which headers are present, and the grammar of the negotiation header values. The User-Agent string and the request path are deliberately excluded, because both are trivially changed and both were measured varying within a single operator, so a scanner that rotates either keeps one fingerprint. The middle section is a presence bitmap rather than a hash, so two tokens can be compared directly to see how many headers the clients differ by.